Decode the Trap: How a Base64 URL Parameter Confirmed You Opened the Email

The subject line did its job before the recipient finished reading it. A recording has been released by Wireless Callera #IgMECWQ. High priority. A voicemail you never knew existed, waiting behind a single button that said Listen Now.

The target was a VP of sales at a technology company, exactly the kind of always-connected, always-curious inbox that clicks first and questions later. The email sailed through every authentication check the organization had. SPF passed. DKIM passed. DMARC returned a best-guess pass. By the numbers, this was a clean message from authorized infrastructure.

It was also a targeted credential-harvesting operation with a reconnaissance payload hidden in plain sight. The final link carried a base64 string that decoded to the recipient's own email address. One click would have told the attacker everything they needed to know: this mailbox is real, it belongs to a named executive, and its owner takes the bait.

The Voicemail That Was Never Recorded

Curiosity is a reliable pretext because it does not trigger the defenses that fear does. A wire-transfer demand invites scrutiny. A released recording invites a click. The display name, CallerHub Service_51174_playnow, was built to look like an automated notification service, the kind of machine-generated sender nobody scrutinizes.

Two copies of the message hit the same mailbox roughly an hour apart, a common tactic to catch the recipient in a different mood or a busier moment. Both were flagged as high importance. Neither carried an attachment. The entire attack lived in one hyperlink.

Authenticated, Signed, and Still Hostile

Here is the part that should bother every security team still treating authentication as a verdict.

The message was sent through Amazon SES from IP 23[.]251[.]226[.]53. The sending domain, raywjohnsonco[.]com, was registered in 2011 through a mainstream registrar, an aged, reputable domain with none of the freshly-registered red flags that reputation engines look for. SES applied a valid DKIM signature for that domain plus a second signature for amazonses[.]com. SPF authorized the SES IP. DMARC landed on a best-guess pass.

Every gateway control that keys off authentication saw a properly signed message from a permitted sender and stepped aside. That is the design flaw, not a configuration mistake. SPF, DKIM, and DMARC answer one question: did this message come from infrastructure the domain owner allows? They say nothing about intent. Attackers rent shared email-sending platforms, or quietly abuse a legitimate account on one, precisely because the platform's authentication travels with the abuse.

According to the 2024 Verizon Data Breach Investigations Report, phishing was present in 15 percent of breaches, and stolen credentials were involved in 38 percent of breaches overall. Clean, link-only messages like this one are the volume leader precisely because they give scanners so little to grab.

Four Redirects to a Vietnamese Server

The Listen Now button did not point anywhere obviously bad. It pointed to Google.

The link chained through a series of national Google open-redirect endpoints, google[.]nl forwarding to google[.]ro forwarding to google[.]it, each wrapping the next in a url?q= parameter. A URL scanner inspecting the first hop sees google and a trusted reputation, and many stop reasoning there. The nesting exists to burn through reputation checks one layer at a time.

The chain terminated at a Google AMP cache path that fronted heritran[.]vn, a compromised Vietnamese website repurposed as the credential-harvesting host, with a related snapshot resolving to ineffable9[.]com. AMP cache URLs add a final coat of legitimacy because the visible domain is Google's, not the attacker's. None of the destinations had anything to do with a voicemail service or the claimed caller.

This is layered evasion by design: a trusted sending platform, an aged signing domain, trusted redirector domains, and an AMP cache wrapper, stacked so that no single link in the chain looks like an attack.

The Base64 Parameter That Named the Target

The real tell was at the very end of the URL. The final path carried a base64-encoded string. Decode it, and it resolved to the recipient's exact email address.

Encoded, a parameter like ZW1wbG95ZWVAY29tcGFueS5jb20= looks like meaningless machine output. Decoded, it reads employee@company[.]com. The attacker had pre-stamped the link with the victim's identity before the email ever sent.

That single detail reframes the whole campaign. The click was never only about serving a fake login page. It was reconnaissance. The moment the target's browser requested that URL, the attacker's server logged a confirmed hit: this specific mailbox is live, actively monitored, and its owner clicks curiosity lures. For a named VP of sales, that is a validated, high-value target ready for the next, more tailored round, whether credential theft, business email compromise, or a follow-on pretext. Mailbox-validation recon like this quietly converts one careless click into a durable entry on a target list.

See Your Risk: Calculate how many threats your SEG is missing

This is where authentication-first filtering runs out of road and behavioral analysis takes over. The Adaptive AI behind Themis did not care that the message was signed. It weighed the signals that actually mattered: a first-time sender, an automated-looking display name aimed at a VIP mailbox, a curiosity lure with forced high priority, and a redirect chain ending in an encoded recipient identifier. Both waves were quarantined within seconds of arrival, well before anyone reached the fake player. IRONSCALES scored the incident as credential theft against a VIP recipient at 90 percent confidence, a verdict SPF and DKIM alone could never produce.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link: the entire payload was a single crafted link built to survive URL scanning.
• T1598.003 Phishing for Information: Spearphishing Link: the base64 recipient parameter turned the click into targeted mailbox-validation reconnaissance.

What This Attack Should Change

Stop treating a passing authentication result as a safety verdict. As the FBI Internet Crime Report documents year after year, business email compromise and credential theft thrive on messages that look perfectly legitimate on the wire. The CISA phishing guidance makes the same point: technical controls have to be paired with detection that reads context and behavior, not just headers.

Three concrete moves follow from this case. First, inspect the full redirect chain, not the first hop, and treat trusted-domain redirectors as evasion until proven otherwise. Second, flag encoded parameters that resolve to internal identifiers, because a recipient's own email in an outbound link is a recon signature, not a feature. Third, layer credential-harvesting protection that scores sender behavior, targeting patterns, and community intelligence, so an authenticated message aimed at a VIP still gets the scrutiny it earns. The 2024 Microsoft Digital Defense Report shows attackers industrializing exactly this kind of low-signal, high-trust delivery. The defense is not another authentication check. It is reading the whole message the way an analyst would.